Extracted

• • Target
    PINK Theme.exe
  • Size 4.7MB
  • SHA256 8be75984d959fd83a384550d4858958974f2e9821215b18b7e4c0e47c3b43ac9
  • MD5 5919b685de68121280db1ece9bc23a2e
  • SHA1 96191471972c0f93435f59beebb43fc2de763673
  • SHA512 717fce8e36cda1811657c9075b4e9e9499fc4fb50b1687e73361bd08452d973cca9e15fd6469065b01fc8fe45a0efbbc6077ae8b6848f0db24231500eb574adb
  • SSDEEP 98304:h5OQHNfk2gC2s4Gn+fGVPxEq55MJS7AdsmumtSF0zJe35x/tq:btHm9i4mU7lJS0dsD0SF0te35xA
  • TLSH
    T13F36023BF28B653EE02A1B357AB2A120583B7E6165124C569AECF48CCF355701D3E787
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutioninstallerbackdooranderemeshagentpersistencerattrojan

  • Detects MeshAgent payload

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2